How to Avoid Phishing Attacks While Working Remotely

That matters more for you than for someone in an office. Your manager might be in New York, six hours behind Lagos in winter. Your pay comes through Deel or Payoneer, and your boss can message you on WhatsApp as easily as on Slack. Each of those is a gap a phisher can use.

This guide covers the phishing messages remote workers actually get, a 30-second check you can run on any message, how attackers get past two-factor codes, and what to do in the first hour after a mistake.

Quick answer

Phishing is a fake message that tries to get your password, your money or access to your device. Remote workers avoid it by never acting on a link, attachment or payment request until they have checked it some other way. That means typing the site address yourself or calling the sender on a known number. Use passkeys or app-based sign-in instead of SMS codes, and report suspicious messages quickly so your employer can contain the damage.

Why remote workers in Nigeria are attractive targets

A phisher wants three things: your work login, your employer's money or your own income. A Nigeria-based remote worker controls all three from a laptop at home, usually without an IT person nearby.

The scale is real. The FBI's Internet Crime Complaint Center (IC3) received more than a million complaints in 2025, with reported losses of about $20.9 billion. Phishing was the most commonly reported type of cybercrime, according to CyberScoop's report on the IC3 2025 figures. Business email compromise (BEC) was the second-largest loss category at almost $3.05 billion. BEC means fooling staff into sending money or changing payment details. These are complaints filed in the US, but many remote workers in Nigeria work inside exactly those US companies' email systems.

Some things make the remote setup riskier:

• Time-zone gaps. A "the CEO needs this now" email that lands at 10pm Lagos time (4pm in New York in winter) catches you tired and unable to reach anyone quickly. Phishers count on that.
• Many accounts. A typical remote contractor has Google Workspace or Microsoft 365, Slack, a payroll platform, a payout app and a personal bank app. That's a lot of login pages to fake.
• Blurred channels. If your team sometimes uses WhatsApp, a message from an unknown number claiming to be your manager doesn't look strange.
• Your pay is a target. If someone changes your payout details on Deel or Remote, your month's income goes to them.
• Local campaigns. Nigerian phishing doesn't only come from abroad. In 2026 the NCC's incident response team warned about a WhatsApp campaign offering 10GB of free data and ₦5,000 airtime that collected phone numbers and spread through contacts. In June 2026 NIMC warned about a fake "free NIN correction" portal built to steal personal data. Personal data stolen this way is often used to make later, work-targeted messages more convincing.

The phishing attacks remote workers actually receive

The UK's National Cyber Security Centre (NCSC) separates mass phishing (one message sent to thousands) from spear phishing, which is targeted and uses details about you or your company to sound believable (NCSC phishing guidance). Remote workers get both. The table shows the common forms and the one check that defeats each.

Credential phishing: the fake login page

This is the most common kind. You get an email or chat message that looks like it's from Microsoft, Google, Okta, Slack or your company's IT team. It links to a page that looks exactly like the real sign-in screen. Whatever you type goes to the attacker.

The giveaway is almost always the address bar, not the page design. Attackers can copy a logo in seconds. They can't use the real domain. The US Cybersecurity and Infrastructure Security Agency (CISA) gives the example of "amazan.com" in place of the real address (CISA: Recognize and report phishing). Look for swapped letters, extra words ("microsoft-login-secure.com") and odd endings.

A password manager helps here. It fills your password only on the genuine domain, so if it stays blank on a page that "should" know you, stop. The NCSC makes the same point. We cover choosing one in the best password managers for remote workers.

Payroll and payout phishing

If you're paid as a contractor through Deel, Remote, Payoneer or a similar platform, expect emails that copy those brands exactly. The lure is usually money: a payment "on hold", a "failed transfer", a tax form "required before release". The link leads to a fake login or a form asking for your bank details.

Never fix a payment problem from a link. Open the app or type the site address yourself. If the problem is real, you'll see it on your dashboard. For which apps people in Nigeria use to receive dollars, see how to receive dollar payments in Nigeria.

Business email compromise and invoice fraud

If your job touches money (bookkeeping, accounts payable, operations, executive assistance, or a VA role paying suppliers), you're the person BEC targets. The classic message: a supplier or client says their bank account has changed and asks you to pay the next invoice to the new one. Sometimes the email really comes from the supplier's hacked mailbox, so the address checks out.

The defence is a process, not sharp eyes. The NCSC recommends confirming important requests like payments or bank-detail changes through a separate channel, such as a phone call or in-person check (NCSC phishing guidance). Call a number you already had on file, never one from the email asking for the change.

Chat-tool and WhatsApp impersonation

Phishing now arrives in Slack, Microsoft Teams, LinkedIn messages and WhatsApp as well as email. A common version uses a manager's name and profile picture. It starts with "Hi, are you available?" and then moves to an urgent favour: buy gift cards, send a file, approve a payment, share a code.

Remember your company's rule on which channel carries real work. If a WhatsApp number you've never saved claims to be your CTO, answer on Slack or email: "Did you just message me on WhatsApp?" Fake job approaches on these apps are a separate problem, covered in how to avoid remote job scams on Telegram and WhatsApp.

Phone phishing (vishing) and fake IT support

A caller claims to be from IT or the security team, often knowing your name and job title from LinkedIn. They say your account is compromised and ask you to read out the code that just arrived on your phone, or to install a "support tool". A genuine IT team won't ask for your one-time code. Hang up and contact IT through the directory or helpdesk link you already use.

The 30-second check to run on any message

You don't need to be a security expert. You need a habit. Before you click, download, approve or pay anything, run through this list:

1. Was I expecting this? An unexpected invoice, password warning or shared file is the classic opener. The FTC's phishing advice lists unrecognised invoices and "confirm your details" requests as standard signs.
2. Is it pushing me to hurry? Deadlines, threats ("your account will be closed") and secrecy ("don't tell anyone yet") are pressure tactics.
3. Does it ask for a login, a code, money or bank details? Those four are what phishers are after. A real request for any of them can survive a second check.
4. Do the sender and link match the real organisation? On a laptop, hover over links. On a phone, long-press to preview the address. Check the sender's actual email address, not only the display name.
5. Can I check it another way? Open the app, type the address, or ask the person on a channel you already use.

Don't take good writing as a sign of safety. CISA notes that good grammar and spelling no longer rule out phishing, because AI tools can now write polished messages. The old "look for typos" advice no longer works.

Example (hypothetical): the Friday-night payout email

Amaka is a customer support contractor in Ibadan, paid monthly through an employer-of-record platform. At 9:40pm on a Friday she gets an email with the platform's logo: "Your October payment could not be processed. Confirm your withdrawal details within 24 hours to avoid delay." The button opens a page that looks just like the platform's login.

Running the check: she wasn't expecting it. It's urgent, and it wants her login and bank details. The link preview shows a domain with an extra word in it. So she closes the email and opens the platform's app from her phone's home screen. Her payment shows as scheduled. She reports the email using her mail app's "report phishing" option and forwards it to her company's security contact. Total time: about three minutes, and her salary is safe.

How phishing gets past two-factor authentication, and what stops it

Two-factor authentication (2FA), also called multi-factor authentication (MFA), means you need something besides your password to sign in: a code, an approval tap or a fingerprint. It blocks most password theft, and the FTC and NCSC both tell you to use it. But some types of 2FA can still be phished.

• Code relaying. The fake login page asks for your password, then your SMS or authenticator code. The attacker types both into the real site within seconds. The code worked, but for the wrong person.
• MFA fatigue (push bombing). The attacker already has your password and keeps triggering approval prompts on your phone, hoping you'll tap "Approve" to make them stop, often in the middle of the night.
• SIM swap. If your codes come by SMS, someone who talks a mobile network into moving your number to a new SIM receives your codes. Your NIN and BVN are linked to your line, which makes this especially risky for Nigerians, because a stolen line can also be used against bank accounts.

What helps:

• Passkeys and security keys. A passkey lets you sign in with your fingerprint, face or phone screen lock instead of a password. Google explains that passkeys can't be typed into a fake sign-in page or handed to someone else, which is why they resist phishing (Google Account help: passkeys). Google also advises creating passkeys only on devices you personally own and use, so don't set one up on a shared family laptop.
• Number matching. In Microsoft Authenticator, number matching is now on for all push notifications (Microsoft Learn: number matching). You have to type the number shown on the sign-in screen into the app. If a prompt appears and there's no sign-in screen in front of you, you have no number to enter. That's your signal it isn't you.
• An authenticator app over SMS for personal accounts like Gmail, your payout app and LinkedIn, where the service allows it.

The rule for any approval prompt you didn't start: deny it, change that account's password, and tell your security team, because it means someone already has your password. For step-by-step setup on common accounts, see how to set up two-factor authentication for work accounts.

Habits that make phishing much less likely to work

Checking messages is half the job. The other half is setting things up so a single mistake does less damage.

Separate work and personal use

Use your work laptop or work browser profile only for work. Don't install pirated software, "free" film apps or random browser extensions on it, because these are common ways malware gets onto a machine. If you have only one laptop, at least use separate browser profiles (Chrome and Edge both offer them) so your work logins aren't sitting next to your personal browsing.

Keep devices updated

Updates fix the security holes that malicious attachments exploit. The FTC recommends setting security software and phone software to update automatically. In Nigeria the usual excuse is data cost. Schedule big updates for when you're on unlimited or off-peak data, but don't put them off for weeks.

Bookmark your important logins

Save bookmarks for your work email, Slack, HR system, payroll platform and payout app. Then you never need a link from a message to reach them. This one habit defeats most credential phishing.

Share less publicly

Spear phishers build their messages from what's public: your LinkedIn job title, your manager's name, the tools your team uses, a post saying you just joined. The NCSC's advice for individuals notes that criminals use information from social media to make scams more convincing, and that reviewing your privacy settings makes you a harder target (NCSC: phishing scams). You can still announce a new job. Just think twice before posting screenshots of internal tools or your onboarding emails.

Don't approve or pay anything while rushed

Many successful phishes happen late at night or while someone is juggling two things during a power cut. If a request involves money, codes or bank details and you can't reach anyone to confirm it, waiting until morning is a perfectly professional answer. Real urgent requests come with a phone call.

Nigeria-specific risks and how to handle them

Time-zone gaps make verification harder

Lagos is on WAT (UTC+1) all year. From 1 November 2026, US Eastern is six hours behind and US Pacific nine. A "please process this before end of day" message from a US colleague may land in your evening, when the real person is unreachable or asleep. Agree a rule with your manager in advance: no payment or bank-detail change goes ahead on email or chat alone. Something like "I'll always confirm payment changes on a call" protects you both, and it's a reasonable thing to raise in your first week.

Power and internet cuts can push you into risky shortcuts

When NEPA takes light and your router dies, you might switch to an unfamiliar Wi-Fi network or a friend's laptop to finish a task. Avoid signing in to work accounts on devices you don't control, because saved sessions and keyloggers stay behind. Use your own phone hotspot or a MiFi instead. Securing your home setup is covered in how to keep your home office network secure.

Your phone line and BVN are part of your security

Because SMS codes, bank alerts and your BVN all hang off your phone number, protect the line itself. Never share an OTP with anyone who calls you, whatever bank, telco or employer they claim to be. If your SIM suddenly loses signal for no clear reason, contact your network quickly from another phone, since that can be a sign of a SIM swap.

Local phishing feeds work phishing

Fake promos, NIN portals and "verify your BVN" messages harvest personal details that can later be used to impersonate you or target you. The NIMC and NCC-CSIRT warnings above both gave the same advice: use only the official portal or channel, and ignore unsolicited offers that ask for your details.

What to do if you clicked a phishing link

Act fast and tell people. The NCSC says some phishing will always get through, and it wants staff to report quickly, including when they have already clicked. It argues that people who fear punishment don't report at all, which makes things worse. Most well-run companies feel the same way. A quick report is almost always better than a quiet hope that nothing happens.

Your first hour:

1. Stop entering anything. Close the page. If you downloaded a file, don't open it again.
2. Report it to your employer's security or IT contact with the message attached or forwarded. Find out the reporting route during onboarding, plus a backup route (such as your manager's phone) in case your email itself is compromised. The NCSC recommends exactly this.
3. Change the password for the account you typed into, from a device you trust, by typing the address yourself. If you reuse that password anywhere, change those too.
4. Sign out other sessions. Google, Microsoft and most platforms let you sign out of all devices from the security settings.
5. Check for changes an attacker would make: new email forwarding rules, a changed recovery phone number, new payout or bank details on your pay platform, unknown devices.
6. If you entered bank or card details, call your bank on the number on the back of your card and ask them to block or watch the account.
7. If you opened an attachment, disconnect from the internet, run a full security scan as the FTC advises, and let IT check the machine before you use it for work again.

Write down what happened and when (Lagos time and the sender's time zone). It helps whoever investigates.

Where to report phishing from Nigeria

Report through your employer first, because they can block the sender for everyone and check whether colleagues were hit. Most email apps also have a "report phishing" button that trains the provider's filters.

Beyond that, it depends on who was impersonated:

• UK-related scams: the NCSC accepts suspicious emails at report@phishing.gov.uk and scam texts to 7726 (NCSC: phishing scams).
• US-related scams: the FTC suggests forwarding phishing emails to reportphishing@apwg.org and reporting at ReportFraud.ftc.gov.
• Impersonated platforms: Deel, Payoneer, Microsoft, Google and the big banks all have abuse or security reporting pages. Find them by typing the company's address, not through the suspicious message.
• Nigerian lures (fake NIMC, telco or bank messages): report to the organisation being impersonated through its official channels, as NIMC itself advised.

If a phishing attempt has cost you money, our guide to remote job scams in Nigeria covers the wider recovery steps.

Frequently asked questions

What is phishing in a remote job?

Phishing is a fake email, text, chat message or call that tries to trick you into giving away a login, a one-time code, money or bank details, or into opening malware. In remote jobs it usually copies tools you use daily, such as Microsoft 365, Google Workspace, Slack or your payroll platform, or pretends to be your manager.

Can phishing bypass two-factor authentication?

Yes, some types. A fake login page can capture an SMS or authenticator code and use it straight away, and push-approval prompts can be abused by flooding you until you tap "Approve". Passkeys and hardware security keys resist this because they won't work on a fake site, and number matching in apps like Microsoft Authenticator makes blind approvals much harder.

What should I do if I clicked a phishing link on my work laptop?

Report it to your employer's security or IT contact immediately, then change the affected password from a trusted device and sign out other sessions. If you opened an attachment, disconnect from the internet and let IT check the machine. Reporting quickly limits the damage far more than staying quiet.

Is an email that uses my name and my manager's name safe?

No, not on that basis alone. Targeted phishing (spear phishing) pulls names, job titles and tool names from LinkedIn and company websites. Judge the request, not the familiarity: if it asks for a login, code, payment or bank change, confirm it through another channel first.

My manager sometimes messages me on WhatsApp. How do I know it's really them?

Check the number against one you've saved, and confirm any unusual request on your main work channel such as Slack or email. Requests for gift cards, codes, money or confidential files from a new or unsaved number are classic impersonation. It's fair to agree with your manager which channels count for anything involving money.

Will I lose my job if I fall for a phishing email?

That depends on your employer, but security bodies such as the UK NCSC advise organisations not to punish people who report, because fear stops reporting. Hiding a click is usually what turns a small incident into a serious one. Report early and be honest about what happened.

Should I use SMS codes or an authenticator app?

Use an authenticator app or a passkey where the service offers one. SMS codes can be stolen through a SIM swap, and in Nigeria your phone number is also tied to your bank alerts and BVN. SMS is still better than no second step at all.

Is a phishing email with perfect English less likely to be fake?

No. CISA warns that good grammar and spelling no longer rule out phishing, because attackers use AI to write polished messages. Check the sender's real address, the link's actual domain and what the message is asking you to do.

Key takeaways

• Treat any unexpected request for a login, code, payment or bank-detail change as suspect until you've confirmed it through a second channel you already trust.
• Reach important sites through bookmarks or apps, never through links in messages, especially your payroll and payout platforms.
• Prefer passkeys or authenticator apps to SMS codes. Deny any approval prompt you didn't start, then change that password.
• Time-zone gaps and power cuts create pressure. Agree with your manager that money and bank changes are always confirmed on a call.
• If you click, report immediately, change the password, sign out other sessions and check for changed payout details or forwarding rules.

Next steps

Spend 20 minutes today bookmarking your work and payout logins, switching your main accounts to a passkey or authenticator app, and finding your company's phishing reporting route. Then read how to set up two-factor authentication for work accounts and the wider cybersecurity tips for people working from home. If you're still looking for a remote role, browse remote jobs open to applicants in Nigeria. Each listing shows the company, its website and where applicants may live, so you can check the employer is real before you apply.

Sources

• Phishing attacks: defending your organisation, National Cyber Security Centre (UK)
• Phishing scams: how to spot and report them, National Cyber Security Centre (UK)
• Recognize and report phishing, CISA
• How to recognize and avoid phishing scams, US Federal Trade Commission
• FBI's Internet Crime Complaint Center annual cybercrime report, CyberScoop (7 April 2026)
• Passkeys, Google Account Help
• How number matching works in MFA push notifications for Authenticator, Microsoft Learn
• Fraudulent "Free Data and Airtime" phishing campaign (NCC-CSIRT-2026-032), Nigerian Communications Commission CSIRT
• NIMC warns Nigerians against fake NIN correction portal, Gazette Nigeria (3 June 2026)